Medusa Ransomware: The RaaS That Blinds Your EDR Before It Encrypts

Background

Medusa is a ransomware-as-a-service (RaaS) variant first identified in June 2021. It began as a closed operation run by a single group and later moved to an affiliate model, though ransom negotiation is still controlled centrally by the core developers. As of early 2025, US authorities attributed more than 300 victims to Medusa across critical-infrastructure sectors including healthcare and medical, education, legal, insurance, technology and manufacturing, with ransom demands reported from roughly $100K into the millions.

A quick name-check, because ‘Medusa’ is one of the most overloaded names in threat intel: this report is about the Medusa RaaS. It is NOT the same as MedusaLocker (a separate, older ransomware family), the Medusa Android banking trojan, or the open-source ‘Medusa’ LD_PRELOAD Linux rootkit on GitHub (and its mislabeled ‘Medusa_Ransomware’ fork), which is a userland rootkit that merely shares the name. Conflating them sends defenders after the wrong indicators.

What we observed

The Medusa playbook is a disciplined, hands-on-keyboard intrusion:

• Bought or exploited access: affiliates frequently buy footholds from initial access brokers, and gain entry through phishing for credentials and exploitation of unpatched internet-facing software, notably ScreenConnect (CVE-2024-1709) and Fortinet FortiClient EMS (CVE-2023-48788).
• Blind the defenses with BYOVD: Medusa’s signature evasion is a bring-your-own-vulnerable-driver attack using a custom, validly signed driver known as ABYSSWORKER to disable endpoint detection and response, alongside clearing PowerShell command history to slow investigators.
• Live off legitimate tooling: for discovery and movement it uses built-in Windows tools (PowerShell, WMI, RDP) and utilities like Advanced IP Scanner and SoftPerfect Network Scanner, and abuses remote-management software (AnyDesk, Atera, ConnectWise, Splashtop, PDQ Deploy) plus PsExec and Cobalt Strike to spread.
• Steal before you scramble (double extortion): sensitive data is exfiltrated to attacker infrastructure, commonly with Rclone, before the encryptor runs, giving the crew a second lever: leak the data on the Tor-based ‘Medusa Blog’ if the victim does not pay.
• Encrypt and inhibit recovery: the encryptor terminates services, deletes volume shadow copies to block rollback, encrypts files with a .medusa extension, and drops a ransom note directing victims to contact the operators over Tor / an encrypted messenger. In at least one case a victim who paid was contacted again and asked for more, a de facto triple-extortion twist.

Medusa ransomware attack chain

Encryption is the last step. The damage (stolen data, disabled defenses, deleted backups) is done before a single file is locked.

Attribution

Medusa is a financially motivated cybercriminal RaaS operation, not a state actor; the profile above is drawn from a joint US government advisory (CISA/FBI/MS-ISAC) and corroborating vendor reporting, so confidence in the TTPs is high. Attribution of any individual intrusion still depends on your own artefacts, since affiliates vary their tooling. And to repeat the earlier caution: the ‘Medusa’ GitHub rootkit repositories are an unrelated Linux LD_PRELOAD rootkit that shares the name. They are not this ransomware and should not be treated as its source.

Confidence: 90%.

Medusa doesn’t just lock your files. It blinds your EDR with a signed driver, steals your data, and puts your name on a blog. Paying rarely ends it.

Tactics, techniques & procedures (MITRE ATT&CK)

Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:

Detection

Copy-ready hunting query:

# Hunt for the Medusa ransomware chain (behaviour-first)
# 1) Edge exploitation of the known entry points
index=* (url="*ScreenConnect*" OR signature="*CVE-2024-1709*" OR signature="*CVE-2023-48788*" OR process="*FcmDaemon*")
# 2) BYOVD: new kernel-driver service creation / suspicious signed driver load (ABYSSWORKER)
index=edr (event_id=7045 service_type="kernel mode driver") OR event="vulnerable_driver_load"
# 3) EDR/AV tamper and PowerShell history clearing
index=edr (event="service_stop" service IN ("*Defender*","*Sense*","*CrowdStrike*","*SentinelOne*")) OR command_line="*Clear-History*" OR command_line="*ConsoleHost_history.txt*"
# 4) Recovery inhibition + living-off-the-land tooling
index=edr (command_line="*vssadmin*delete*shadows*" OR command_line="*wmic*shadowcopy*delete*") OR process_name IN ("PsExec.exe","rclone.exe","advanced_ip_scanner.exe","netscan.exe")
# 5) Unsanctioned remote-management tools and impact
index=edr (process_name IN ("anydesk.exe","ateragent.exe","connectwisecontrol*","splashtop*","pdqdeploy*")) OR file_name="*.medusa" OR file_name="*READ_ME_MEDUSA*"

# The full hash / IP / Tox-ID indicator set is published in the CISA #StopRansomware: Medusa advisory (AA25-071A) -- load it into your SIEM/EDR.

Recommendations

• Shut the front door: prioritise patching internet-facing software Medusa targets (ScreenConnect CVE-2024-1709, Fortinet FortiClient EMS CVE-2023-48788 and similar), enforce MFA on all remote access and email, and put edge/VPN appliances on an aggressive patch cadence.
• Neutralise BYOVD: enable Microsoft’s Vulnerable Driver Blocklist and HVCI (Memory Integrity), enforce WDAC/attack-surface-reduction rules on driver loading, and alert on new kernel-driver service creation, a valid signature is not proof of trust.
• Detect the blinding and the recovery kill: alert on EDR/AV service stops or lost telemetry, PowerShell history clearing, and shadow-copy deletion (vssadmin/wmic). These fire before encryption and are your early warning.
• Control the living-off-the-land tools: allowlist remote-management software (AnyDesk, Atera, ConnectWise, Splashtop, PDQ Deploy), monitor PsExec and Rclone, and segment the network so a single foothold cannot reach everything.
• Plan for double (and triple) extortion: keep tested offline/immutable backups, rehearse an IR plan that assumes data theft, and do not treat payment as closure, Medusa has re-extorted victims who already paid; engage incident response and report to national authorities (CISA/FBI advisory AA25-071A).